Skip to content

Bump the python group across 1 directory with 18 updates - #36

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-da77fb07ae
Open

Bump the python group across 1 directory with 18 updates#36
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-da77fb07ae

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the python group with 18 updates in the / directory:

Package From To
cryptography 50.0.1 50.0.2
django 6.0.8 6.1.2
django-allauth[mfa,socialaccount] 65.19.2 65.20.0
hiredis 3.4.1 3.5.0
pglast 8.4 8.7
psycopg[binary] 3.3.5 3.3.6
py-key-value-aio[filetree,wrappers-encryption] 0.4.5 0.4.6
uvicorn[standard] 0.52.4 0.54.0
coverage 7.16.0 7.16.2
django-stubs[compatible-mypy] 6.1.0 6.1.2
django-upgrade 1.32.0 1.33.0
djlint 1.46.1 1.46.6
mypy 2.3.1 2.4.0
pre-commit 4.6.2 4.7.0
ruff 0.16.6 0.17.1
sphinx 9.1.0 9.1.1
watchfiles 1.2.0 1.3.0
werkzeug[watchdog] 3.1.8 3.1.9

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.

.. _v50-0-1:

Commits

Updates django from 6.0.8 to 6.1.2

Commits

Updates django-allauth[mfa,socialaccount] from 65.19.2 to 65.20.0

Commits

Updates hiredis from 3.4.1 to 3.5.0

Release notes

Sourced from hiredis's releases.

3.5.0

This release updates the bundled hiredis C library to v1.5.0, adds wheels for Python 3.15, and drops support for Python 3.8.

Breaking Changes

  • Drop Python 3.8 support (#258)

    python_requires is now >=3.9, and no more cp38 wheels will be published. pip on Python 3.8 will keep resolving to hiredis 3.4.x.

🚀 New Features

  • Bump hiredis to v1.5.0 (#257)

    redis/hiredis#1323

  • Build wheels for Python 3.15 (#255)

    Wheels are now built with cibuildwheel 4.x and cover CPython 3.15 and free-threaded 3.15t.

🧰 Maintenance

  • Add security policy (#245)
  • Update dependencies and fix CI (#233)
  • Fix benchmarking for hiredis-py (#232)
  • Remove outdated spell check workflow (#259)

This release also includes the fixes that already shipped in 3.4.1 (hiredis v1.4.1, #243) and 3.4.2 (a push notification memory leak fix, #239).

Contributors

We'd like to thank all the contributors who worked on this release!

@​mmick78, @​MugundanMCW, @​shaanmajid, @​uglide and @​vladvildanov

3.4.2

This is a bugfix release. Users of hiredis-py 3.4.x that receive RESP3 push notifications — pub/sub deliveries or client-side cache invalidations — are encouraged to upgrade.

🐛 Bug Fixes

  • Release the list each push notification is sized from (#239)

PushNotificationType_New pre-sized every PushNotification with a list that PyList_SetSlice only borrows, and the reference was never dropped. Each RESP3 push notification therefore stranded one list object for the lifetime of the process. Because push notifications carry pub/sub deliveries and client-side caching invalidations, the leak grew with message volume rather than with the number of connections, making it unbounded for a long-lived subscriber — roughly 20 MB per 200,000 four-element notifications, and more for larger ones. Dropping the reference also removes an allocation from the parse path, which makes parsing a small notification about 10% faster.

The same change checks PyList_New for failure and guards tryParentize against a NULL reply, so an allocation failure is now reported as an error instead of writing elements past the end of a zero-length notification.

RESP2 array replies were never affected.

Contributors

Thanks to @​mmick78 for finding and fixing this.

Commits

Updates pglast from 8.4 to 8.7

Changelog

Sourced from pglast's changelog.

8.7 (2026-10-18)


- Fix regression in the `CollateClause` printer (issue `[#222](https://github.com/lelit/pglast/issues/222)`__)

__ lelit/pglast#222


8.6 (2026-10-14)

  • Fix AST typing and serialized child construction (PR [#220](https://github.com/lelit/pglast/issues/220)__), thanks to Alexander Macdonald

    __ lelit/pglast#220

  • Fix the parenthesization of expression operands, replacing the previous ad-hoc heuristics with proper precedence and position rules (issue [#211](https://github.com/lelit/pglast/issues/211)__): note that many printer functions had to be changed to use new methods in RawStream, primarily print_operand()

    __ lelit/pglast#211

  • Fix two missing spaces in the single-line form of a list when the compact_lists_margin option is in use

8.5 (2026-10-04)


- Fix handling of ``NOT ENFORCED`` constraints (`PR [#208](https://github.com/lelit/pglast/issues/208)`__), thanks to
  Bolaji Wahab

__ lelit/pglast#208

Commits

Updates psycopg[binary] from 3.3.5 to 3.3.6

Changelog

Sourced from psycopg[binary]'s changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.7 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Fix segfault fetching arrays of strings or timestamps after closing the connection (:ticket:[#1428](https://github.com/psycopg/psycopg/issues/1428)).
  • Fix ~Connection.cancel_safe() failing if the cancel connection is not ready immediately, for instance on a slow network (:ticket:[#1440](https://github.com/psycopg/psycopg/issues/1440)).

Current release

Psycopg 3.3.6 ^^^^^^^^^^^^^

  • Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).
  • Improve performance of async queries by reducing the overhead of the !wait_async() function (:ticket:[#1331](https://github.com/psycopg/psycopg/issues/1331)).
  • Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).
  • Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).
  • Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).
  • Fix dumping of nested subclasses of lists as arrays (:ticket:[#1398](https://github.com/psycopg/psycopg/issues/1398)).
  • Discard prepared statements upon :sql:DEALLOCATE ALL (:ticket:[#1408](https://github.com/psycopg/psycopg/issues/1408)).
  • Better guards dumping large Python !int to binary numeric (:ticket:[#1414](https://github.com/psycopg/psycopg/issues/1414)).

Psycopg 3.3.5 ^^^^^^^^^^^^^

  • Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
  • Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
  • Fix !wait_selector wait function to not raise !KeyError

... (truncated)

Commits
  • a67654d chore: bump psycopg package version to 3.3.6
  • 443814b Merge pull request #1416 from dvarrazzo/wait-async-perf
  • 42966e9 test: add helpful comments to some tests
  • 5e8797f test: add reasonable connect_timeout to most tests
  • c81ba62 perf: reduce the overhead of wait_async()
  • d2bbfe4 refactor: use get_running_loop() in the async wait functions
  • 2b1484a test: add a script to measure the async wait functions
  • 573cf4a test: fix incorrect wait timing test
  • 2b68990 refactor: drop leftovers of waiting with inf interval in wait_conn_async
  • 60765dd Merge pull request #1414 from dvarrazzo/fix-decimal-overflow
  • Additional commits viewable in compare view

Updates py-key-value-aio[filetree,wrappers-encryption] from 0.4.5 to 0.4.6

Updates uvicorn[standard] from 0.52.4 to 0.54.0

Release notes

Sourced from uvicorn[standard]'s releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0
  • Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
  • HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

  • Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

  • Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
  • Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
  • Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn[standard]'s changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

  • Add experimental HTTP/2 support through zttp (#2982, #3101)
  • Add support for zuvloop (#3104)

Fixed

  • Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
  • Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
  • Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)
Commits

Updates coverage from 7.16.0 to 7.16.2

Release notes

Sourced from coverage's releases.

7.16.2

Version 7.16.2 — 2026-09-27

  • Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.
  • Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.
  • Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️  PyPI page: coverage 7.16.2. :arrow_right:  To install: python3 -m pip install coverage==7.16.2

7.16.1

Version 7.16.1 — 2026-09-13

  • Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
  • Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.
  • Fix: the Total row in the footer of the HTML report’s index page was recomputed in JavaScript with rounding that could disagree with the total the server rendered in the heading, including showing 100% when coverage was not complete. The footer now clamps values the way the rest of the report does, and when nothing is filtered out it is shown exactly as the server rendered it, so the two can’t disagree. That also keeps rows the report omits (--skip-covered drops fully covered files) in the total. Fixes issue 2256.

➡️  PyPI page: coverage 7.16.1. :arrow_right:  To install: python3 -m pip install coverage==7.16.1

Changelog

Sourced from coverage's changelog.

Version 7.16.2 — 2026-09-27

  • Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168_.

  • Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289_.

  • Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923_.

.. _issue 1923: coveragepy/coveragepy#1923 .. _issue 2168: coveragepy/coveragepy#2168 .. _issue 2289: coveragepy/coveragepy#2289

.. _changes_7-16-1:

Version 7.16.1 — 2026-09-13

  • Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

  • Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

  • Fix: the Total row in the footer of the HTML report's index page was recomputed in JavaScript with rounding that could disagree with the total the server rendered in the heading, including showing 100% when coverage was not complete. The footer now clamps values the way the rest of the report does, and when nothing is filtered out it is shown exactly as the server rendered it, so the two can't disagree. That also keeps rows the report omits (--skip-covered drops fully covered files) in the total. Fixes issue 2256_.

.. _issue 1563: coveragepy/coveragepy#1563 .. _issue 2256: coveragepy/coveragepy#2256 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Commits

Updates django-stubs[compatible-mypy] from 6.1.0 to 6.1.2

Release notes

Sourced from django-stubs[compatible-mypy]'s releases.

6.1.2

What's Changed

New Contributors

Full Changelog: typeddjango/django-stubs@6.1.1...6.1.2

6.1.1

Highlight

This release does some changes around Manager / RelatedManager and the auto generated objects attribute to work better with typechecker like pyright / ty / pyrefly and be more strict about the fact that MyModel().objects is not valid.

However, to support that, existing broad annotations of related managers need to be narrowed or access to these related managers will be flagged as an error. For ex:

from django.db import models
from django_stubs_ext.db.models.manager import ManyRelatedManager, RelatedManager
class Article(models.Model):

category_set: Manager[Category]


category_set: RelatedManager[Category]


tags: Manager[Tag, ArticleTag]


tags: ManyRelatedManager[Tag, ArticleTag]

If you use the mypy plugin, you should also be able to drop these annotation completely in most cases. The plugin infers these types automatically.

See https://github.com/typeddjango/django-stubs#do-i-need-to-annotate-reverse-relations

What's Changed

... (truncated)

Commits

Updates django-upgrade from 1.32.0 to 1.33.0

Changelog

Sourced from django-upgrade's changelog.

1.33.0 (2026-10-02)

  • Reduce garbage collection frequency while fixing files, yielding a performance improvement of 2-7%, depending on Python version. Measured on the source code of Django, Saleor, Wagtail, and Zulip, with no changes to make, the median speedups were ~7% on Python 3.11, ~3% on Python 3.13, and ~2% on Python 3.14, with no change in peak memory usage.

    PR [#735](https://github.com/adamchainz/django-upgrade/issues/735) <https://github.com/adamchainz/django-upgrade/pull/735>__.

  • Speed up the AST traversal by skipping fields that never contain nodes for fixers, such as expression contexts, yielding a further performance improvement of 3-7% on the same projects.

    PR [#736](https://github.com/adamchainz/django-upgrade/issues/736) <https://github.com/adamchainz/django-upgrade/pull/736>__.

  • Only call fixers for function calls, names, and attributes with names they handle, yielding a further performance improvement of 23-29% on the same projects. Combined with the above changes, django-upgrade is now 27-38% faster on these projects.

    PR [#737](https://github.com/adamchainz/django-upgrade/issues/737) <https://github.com/adamchainz/django-upgrade/pull/737>__.

Commits

Updates djlint from 1.46.1 to 1.46.6

Release notes

Sourced from djlint's releases.

v1.46.6

Packaging

  • Ship the license of the mypyc runtime, which the binary wheels include, in LICENSE-THIRD-PARTY.
  • Upload PEP 740 attestations to PyPI, so you can verify that the distributions were published from the GitHub Actions workflow of this repository.

v1.46.5

Packaging

  • Drop support for EoL Python 3.10.

v1.46.4

Fix

  • A line that opens a template block now indents the lines inside it when the rest of the line looks like a single-line html tag. Before, html in a string argument, as in {% call modal("<strong>" ~ n ~ "</strong>") %}, or inline html right after the opening tag, as in {% if a %}<b>x</b>, left the block's contents at its own level, and its closing tag ended up one level too far out.

v1.46.3

Performance

  • A long run of unclosed {{ or {% no longer makes linting and formatting quadratic. Each was read again from every opener to the end of the line or the file, so eight thousand {{ on one line took over half a minute to lint and as long again to format, and twenty thousand in one attribute value took H054 alone 80 seconds; each now takes well under a second. A second opener is taken to mean the first one never closed, which is how the tokenizer already read them. T038 still reads an unclosed {% up to the next %}, as django does, so a run of those stays slow there.

Fix

  • A > inside a string of a template tag no longer ends the html tag around it when the string reuses the attribute's quote, as in class="{{ classes|default:"[&>a]:flex" }}". Before, the linter lost the rest of the tag, so H037 missed a repeated attribute after it, and the formatter put a line break inside the string.
  • H054 no longer reads an attribute out of a {# #} comment in another attribute's value, as in <a title="{# " href #}">, and leaves an input alone when an {% if %} writes its type and another tag writes the value, as in {% if shown %}type="{% if hidden %}hidden{% else %}text{% endif %}"{% endif %}.
  • A {# inside a {{ }} or {% %} tag, as in {{ "{# x" }} or an ICU message such as {n, plural, one {# item} other {# items}}, no longer opens a comment that runs to the next #} in the file. Before, the linter skipped everything in between, so T038 reported the {% if %} before it as unclosed and T041 missed an {% extends %} after it, and the formatter left the lines in between unformatted. A tag ends at its first closing delimiter, which is where django ends it.

v1.46.2

Docs

  • Each option on the configuration page now carries the release that brought it, so a reader held to an older djLint can tell at a glance what is there to reach for. The page's filter searches the versions too.
  • djLint publishes its own json schema at https://djlint.com/schema/djlint.json.

Packaging

  • The minimum required regex version is lowered from 2022.6.2 back to 2021.8.21, the first release that ships wheels for Python 3.10, which is djLint's own minimum.
Changelog

Sourced from djlint's changelog.

[1.46.6] - 2026-10-15

Packaging

  • Ship the license of the mypyc runtime, which the binary wheels include, in LICENSE-THIRD-PARTY.
  • Upload PEP 740 attestations to PyPI, so you can verify that the distributions were published from the GitHub Actions workflow of this repository.

[1.46.5] - 2026-10-14

Packaging

  • Drop support for EoL Python 3.10.

[1.46.4] - 2026-10-01

Fix

  • A line that opens a template block now indents the lines inside it when the rest of the line looks like a single-line html tag. Before, html in a string argument, as in {% call modal("<strong>" ~ n ~ "</strong>") %}, or inline html right after the opening tag, as in {% if a %}<b>x</b>, left the block's contents at its own level, and its closing tag ended up one level too far out.

[1.46.3] - 2026-09-28

Performance

  • A long run of unclosed {{ or {% no longer makes linting and formatting quadratic. Each was read again from every opener to the end of the line or the file, so eight thousand {{ on one line took over half a minute to lint and as long again to format, and twenty thousand in one attribute value took H054 alone 80 seconds; each now takes well under a second. A second opener is taken to mean the first one never closed, which is how the tokenizer already read them. T038 still reads an unclosed {% up to the next %}, as django does, so a run of those stays slow there.

Fix

  • A > inside a string of a template tag no longer ends the html tag around it when the string reuses the attribute's quote, as in class="{{ classes|default:"[&>a]:flex" }}". Before, the linter lost the rest of the tag, so H037 missed a repeated attribute after it, and the formatter put a line break inside the string.
  • H054 no longer reads an attribute out of a {# #} comment in another attribute's value, as in <a title="{# " href #}">, and leaves an input alone when an {% if %} writes its type and another tag writes the value, as in {% if shown %}type="{% if hidden %}hidden{% else %}text{% endif %}"{% endif %}.
  • A {# inside a {{ }} or {% %} tag, as in {{ "{# x" }} or an ICU message such as {n, plural, one {# item} other {# items}}, no longer opens a comment that runs to the next #} in the file. Before, the linter skipped everything in between, so T038 reported the {% if %} before it as unclosed and T041 missed an {% extends %} after it, and the formatter left the lines in between unformatted. A tag ends at its first closing delimiter, which is where django ends it.

[1.46.2] - 2026-09-19

Docs

  • Each option on the configuration page now carries the release that brought it, so a reader held to an older djLint can tell at a glance what is there to reach for. The page's filter searches the versions too.
  • djLint publishes its own json schema at https://djlint.com/schema/djlint.json.

Packaging

  • The minimum required regex version is lowered from 2022.6.2 back to 2021.8.21, the first release that ships wheels for Python 3.10, which is djLint's own minimum.
Commits
  • 1399b56 v1.46.6
  • bf7dd73 ci: upload PEP 740 attestations to PyPI
  • c9090c0 build: ship the license of the mypyc runtime (#2673)
  • 08b7d49 chore: add python 3.16 classifier
  • c446cdb v1.46.5
  • f442e3e chore(deps): lock file maintenance (#2672)
  • 1ad846f chore(deps): update pre-commit hook rbubley/mirrors-prettier to v3.9.10 (#2671)
  • df331ca test: add direct tests for branch contexts
  • bc7239d chore(deps): lock file maintenance (#2670)
  • 78c42ba chore(deps): update pre-commit hook tombi-toml/tombi-pre-commit to v1.8.1 (#2...
  • Additional commits viewable in compare view

Updates mypy from 2.3.1 to 2.4.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.4

We've just uploaded mypy 2.4.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Python 3.15 Support

Mypy 2.4 supports running on Python 3.15 and type checking most Python 3.15 features. This includes the new builtin sentinel type for sentinel values (PEP 661), which mypy now supports (see below for details). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) are also supported. Closed TypedDicts (PEP 728) have been supported since mypy 2.2, but the extra_items TypedDict argument, also introduced in PEP 728, is still unsupported. Support for extra_items will be added in a future mypy release.

Native Parser Enabled by Default

Mypy now uses the new native parser by default. It's based on the Ruff parser, and it's significantly faster than the legacy parser, which uses the stdlib ast module. The native parser also has other benefits:

  • You can target newer Python versions and use recent Python syntax even when running mypy on an older Python version. For example, you can use --python-version 3.15 when running mypy on Python 3.14.
  • Stub files can use syntax that is newer than the target Python version. For example, stubs can use the PEP 695 generic class syntax (class Box[T]: ...) when running on or targeting Python 3.10.
  • Parallel type checking requires the native parser.

The legacy parser is still available through --no-native-parser, or native_parser = False in the config file (native_parser = false under [tool.mypy] in pyproject.toml). We are planning to remove the legacy parser in early 2027. If you run into a problem with the native parser, please report it on the issue tracker.

Unlike the legacy parser, the native parser doesn't support type comments for variables defined by for and with statements. These type comments are silently ignored, and the types of the variables are

... (truncated)

Commits

@dependabot
Bump the python group across 1 directory with 18 updates
b3b3043 
Bumps the python group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.1` | `50.0.2` |
| [django](https://github.com/django/django) | `6.0.8` | `6.1.2` |
| [django-allauth[mfa,socialaccount]](https://github.com/sponsors/pennersr) | `65.19.2` | `65.20.0` |
| [hiredis](https://github.com/redis/hiredis-py) | `3.4.1` | `3.5.0` |
| [pglast](https://github.com/lelit/pglast) | `8.4` | `8.7` |
| [psycopg[binary]](https://github.com/psycopg/psycopg) | `3.3.5` | `3.3.6` |
| py-key-value-aio[filetree,wrappers-encryption] | `0.4.5` | `0.4.6` |
| [uvicorn[standard]](https://github.com/Kludex/uvicorn) | `0.52.4` | `0.54.0` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.16.0` | `7.16.2` |
| [django-stubs[compatible-mypy]](https://github.com/typeddjango/django-stubs) | `6.1.0` | `6.1.2` |
| [django-upgrade](https://github.com/adamchainz/django-upgrade) | `1.32.0` | `1.33.0` |
| [djlint](https://github.com/djlint/djLint) | `1.46.1` | `1.46.6` |
| [mypy](https://github.com/python/mypy) | `2.3.1` | `2.4.0` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.2` | `4.7.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.6` | `0.17.1` |
| [sphinx](https://github.com/sphinx-doc/sphinx) | `9.1.0` | `9.1.1` |
| [watchfiles](https://github.com/samuelcolvin/watchfiles) | `1.2.0` | `1.3.0` |
| [werkzeug[watchdog]](https://github.com/pallets/werkzeug) | `3.1.8` | `3.1.9` |



Updates `cryptography` from 50.0.1 to 50.0.2
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.1...50.0.2)

Updates `django` from 6.0.8 to 6.1.2
- [Commits](django/django@6.0.8...6.1.2)

Updates `django-allauth[mfa,socialaccount]` from 65.19.2 to 65.20.0
- [Commits](https://github.com/sponsors/pennersr/commits)

Updates `hiredis` from 3.4.1 to 3.5.0
- [Release notes](https://github.com/redis/hiredis-py/releases)
- [Changelog](https://github.com/redis/hiredis-py/blob/master/CHANGELOG.md)
- [Commits](redis/hiredis-py@v3.4.1...v3.5.0)

Updates `pglast` from 8.4 to 8.7
- [Changelog](https://github.com/lelit/pglast/blob/v8/CHANGES.rst)
- [Commits](lelit/pglast@v8.4...v8.7)

Updates `psycopg[binary]` from 3.3.5 to 3.3.6
- [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst)
- [Commits](psycopg/psycopg@3.3.5...3.3.6)

Updates `py-key-value-aio[filetree,wrappers-encryption]` from 0.4.5 to 0.4.6

Updates `uvicorn[standard]` from 0.52.4 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.4...0.54.0)

Updates `coverage` from 7.16.0 to 7.16.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.16.0...7.16.2)

Updates `django-stubs[compatible-mypy]` from 6.1.0 to 6.1.2
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.1.0...6.1.2)

Updates `django-upgrade` from 1.32.0 to 1.33.0
- [Changelog](https://github.com/adamchainz/django-upgrade/blob/main/docs/changelog.rst)
- [Commits](adamchainz/django-upgrade@1.32.0...1.33.0)

Updates `djlint` from 1.46.1 to 1.46.6
- [Release notes](https://github.com/djlint/djLint/releases)
- [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md)
- [Commits](djlint/djLint@v1.46.1...v1.46.6)

Updates `mypy` from 2.3.1 to 2.4.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.1...v2.4.0)

Updates `pre-commit` from 4.6.2 to 4.7.0
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.2...v4.7.0)

Updates `ruff` from 0.16.6 to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.6...0.17.1)

Updates `sphinx` from 9.1.0 to 9.1.1
- [Release notes](https://github.com/sphinx-doc/sphinx/releases)
- [Changelog](https://github.com/sphinx-doc/sphinx/blob/master/CHANGES.rst)
- [Commits](sphinx-doc/sphinx@v9.1.0...v9.1.1)

Updates `watchfiles` from 1.2.0 to 1.3.0
- [Release notes](https://github.com/samuelcolvin/watchfiles/releases)
- [Commits](samuelcolvin/watchfiles@v1.2.0...v1.3.0)

Updates `werkzeug[watchdog]` from 3.1.8 to 3.1.9
- [Release notes](https://github.com/pallets/werkzeug/releases)
- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst)
- [Commits](pallets/werkzeug@3.1.8...3.1.9)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: django
  dependency-version: 6.1.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: django-allauth[mfa,socialaccount]
  dependency-version: 65.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: hiredis
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pglast
  dependency-version: '8.7'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: psycopg[binary]
  dependency-version: 3.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: py-key-value-aio[filetree,wrappers-encryption]
  dependency-version: 0.4.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: uvicorn[standard]
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: coverage
  dependency-version: 7.16.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: django-stubs[compatible-mypy]
  dependency-version: 6.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: django-upgrade
  dependency-version: 1.33.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: djlint
  dependency-version: 1.46.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pre-commit
  dependency-version: 4.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: sphinx
  dependency-version: 9.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: watchfiles
  dependency-version: 1.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: werkzeug[watchdog]
  dependency-version: 3.1.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants